Note: This is an archival copy of Security Sun Alert 200974 as previously published on http://sunsolve.sun.com.|
Latest version of this security advisory is available from http://support.oracle.com as Sun Alert 1000734.1.
Date of Resolved Release
A vulnerability in certain releases of the Sun Java System Web Server ...
A vulnerability in certain releases of the Sun Java System Web Server (formerly Sun ONE Web Server and iPlanet Web Server) may allow a remote user to cause the web server to become unresponsive, causing a Denial-of-Service (DOS) condition.
2. Contributing Factors
This issue can occur in the following releases:
The server becomes unresponsive.
To work around the described issue, sites may wish to temporarily disable Java for all Web Server instances (Java is enabled by default), by doing the following :
To start an Admin Server instance, open a Windows command prompt and use the command line to start or stop an Admin Server, as in the following example:
1) Change to the installation directory for the Web Server Admin Server. For example, using the default directory:
% cd \Sun\Webserver\https-admserv
2) Start the Web Server Admin Server process:
1. Use the menu from the "Start" then "Programs" selections, or Double-click the "Start Web Server Administration Server" icon (if installed on the Desktop), then:
2. Log in to the admin tool by going to the http://<hostname>:<port>
3. Select the Admin Server instance and click the "Manage" button.
4. Click the "Java" tab and open the "Enable/Disable Servlet/JSP" link
5. Uncheck "Enable Java Globally"
6. Click "OK" and "Apply All Changes" then restart the instance
Note: If you disable Java in this fashion, you will no longer be able to run Java applications for that instance. It is recommended to upgrade to the latest service pack if the workaround is unsuitable for your environment. Please use the link below in "Resolution" for Service Pack download information.
This issue is addressed in the following releases:
Sun Java System Web Server 6.0 Service Pack 8 is available for download at http://wwws.sun.com/software/download/products/40968fe6.html.
Copyright 2000-2010 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.
Sun Java System Web Server
This solution has no attachment